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Re: 



Preliminary Notice of Possible Compliance Incident Involving hr Re Application 




Dear Judge Walton: 



Pursuant to Rule 10(c) of the Foreign Intelligence Surveillance Court (FISC) Rules of 
Procedure, effective February 17, 2006, this letter provides preliminary notice of a possible 
compliance incident regarding the National Security Agency’s (NSA) activities pursuant to 
docket number BR 09-01 and previous docket numbers. (TS) — 

On March 5, 2009, in docket number BR 09-01, you approved an application for tangible 




authority expires on May 29, 2009. (TS//SI//NF) 
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The Primary Order in docket number BR 09-01 prohibits the government “from 
accessing business records metadata acquired pursuant to this Court’s orders in the above- 
captioned docket and its predecessors (‘BR metadata’) for any purpose except as described 
herein.” Docket Number BR 09-01, Primary Order at 4. Access to the BR metadata is 
authorized “for the purposes of ensuring data integrity and developing and testing any 
technological measures designed to enable NSA to comply with the Court’s orders,” and for 
contact chaining and using Court-approved telephone identifiers or, in the case 

of imminent threat to human life, telephone identifiers that NSA has determined meets the 
Court’s reasonable articulable suspicion standard. Id. at 4-7. (TS//SI//NF) — 

On April 30, 2009, NSA notified the Department of Justice’s National Security Division 
(NSD) that as part of NSA’s end-to-end system engineering and process review it was learned 
that NSA data integrity analysts place certain BR metadata 

in a repository known as According to NSA. are 

telephone identifiers that are assigned to 

is a repository of identifiers and other information, including 
the contained in the BR metadata, that NSA has detennined should not be 

queried/tasked. NSA analysts use this repository before numbers are tasked. On May 1, 2009, 
the NSD notified NSA that it should no longer place contained in the BR metadata in 

or any other repository for the purposes described above. On May 1, 2009, the 
NSD notified a Court advisor of this matter by telephone. (T3//SI//NF) 

On May 4, 2009, NSA notified the NSD that other telephone identifiers 

contained in the BR metad ata, not limited to( | are placed in repositories, possibly not 
limited to that NSA uses to identify selectors that should not be used for 

querying/tasking. According to NSA, a limited number of analysts at NSA, including those who 
had not been authorized to access the BR metadata under Orders entered under docket number 
BR 09-01 and previous docket numbers, use these repositories to determine if a telephone 
identifier of interest should not be queried/tasked. None of these telephone 

identifiers is availa ble for contact chaining or ( | in | (and are not 

included in the | database that is used for chaining and jjof the BR 

metadata. NSA informed the NSD that this practice continued after the Court entered its initial 
Order in this matter. According to NSA, beginning on May 1 , 2009, NSA took steps to identify 
the BR metadata and repositories used for the purposes described above and to block access to 
that BR metadata. NSA further stated that it would no longer place BR metadata in repositories 
for the purposes described above, absent authorization from the Court. (TS//SI//NF) — 
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On May 5, 2009, the NSD notified NSA that it should no longer place BR metadata of 
any land in any repository for the purposes described above and should begin to take steps to 
prevent all access to any BR metadata contained in such repositories. The NSD is working with 
NSA to provide a thorough explanation of this matter, which will be provided to the Court in the 
government’s report following the completion of the end-to-end system engineering and process 
reviews as required by the Court’s Primary Order in BR 09-01 at pages 9 to 10. (TS//SI//NF) 



Sincerely, 




National Security Division 
U.S. Department of Justice 
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